PPTP - Unmaintained

TomEastep

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
“GNU Free Documentation
License”.

Warning

I have not used PPTP in years and as a consequence, this document is
no longer maintained (any volunteers?).

As far as I know, the information regarding Shorewall configuration
is still valid but the configurations shown for for the other components
may no longer work. For the most part, they show configuration files that
I used when I worked for Compaq™ and used PPTP as my
work VPN.

Preliminary Reading

I recommend reading the VPN
Basics article if you plan to implement any type of VPN.

PPTP Server Running on your Firewall

Configuring Samba

You will need a WINS server (Samba configured to run as a WINS
server is fine). Global section from /etc/samba/smb.conf on my WINS
server (192.168.1.3) is:

I am the only user who connects to the server but I may connect
either with or without a domain being specified. The system I connect
from is my laptop so I give it the same IP address when tunneled in at
it has when I use its wireless LAN card around the house.

Configuring pptpd

Note

I specify the /etc/ppp/options.poptop file as my ppp options
file (I have several).

The local IP is the same as my internal interface's
(192.168.1.254).

I have assigned a remote IP range that overlaps my local
network. This, together with “proxyarp” in my
/etc/ppp/options.poptop file make the remote hosts look like they
are part of the local subnetwork.

I use this file to start/stop pptpd -- I have this in
/etc/init.d/pptpd:

Configuring Shorewall

Basic Setup

Here' a basic setup that treats your remote users as if they
were part of your loc zone. Note that
if your primary Internet connection uses ppp0, then be sure that
loc follows net in /etc/shorewall/zones.

/etc/shorewall/tunnels:

#TYPE ZONE GATEWAY GATEWAY ZONE
pptpserver net 0.0.0.0/0

/etc/shorewall/interfaces:

#ZONE INTERFACE BROADCAST OPTIONS
loc ppp+

Remote Users in a Separate Zone

If you want to place your remote users in their own zone so that
you can control connections between these users and the local network,
follow this example. Note that if your primary Internet connection
uses ppp0 then be sure that vpn
follows net in /etc/shorewall/zones
as shown below.

I use the combination of interface and hosts file to define the
“cpq” zone because I also run a PPTP server on my firewall
(see above). Using this technique allows me to distinguish clients of my
own PPTP server from arbitrary hosts at Compaq; I assign addresses in
192.168.1.0/24 to my PPTP clients and Compaq doesn't use that RFC1918
Class C subnet.

I use this script in /etc/init.d to control the client. The reason
that I disable ECN when connecting is that the Compaq tunnel servers don't
do ECN yet and reject the initial TCP connection request if I enable ECN
:-(

PPTP Client running on your Firewall with PPTP Server in an ADSL
Modem

Some ADSL systems in Europe (most notably in Austria and the
Netherlands) feature a PPTP server builtinto an ADSL “Modem”.
In this setup, an Ethernet interface is dedicated to supporting the PPTP
tunnel between the firewall and the “Modem” while the actual
Internet access is through PPTP (interface ppp0). If you have this type of
setup, you need to modify the sample configuration that you downloaded as
described in this section. These changes are in
addition to those described in the QuickStart
Guides.

Lets assume the following:

ADSL Modem connected through eth0

Modem IP address = 192.168.1.1

eth0 IP address = 192.168.1.2

The changes you need to make are as follows:

Add this entry to /etc/shorewall/zones:

#ZONE TYPE
modem ipv4

That entry defines a new zone called “modem” which
will contain only your ADSL modem.

Add the following entry to /etc/shorewall/interfaces:

#ZONE INTERFACE BROADCAST OPTIONS
modem eth0 192.168.1.255 dhcp

You will of course modify the “net” entry in
/etc/shorewall/interfaces to specify “ppp0” as the
interface as described in the QuickStart Guide corresponding to your
setup.

Add the following to /etc/shorewall/tunnels:

#TYPE ZONE GATEWAY GATEWAY ZONE
pptpclient modem 192.168.1.1

That entry allows a PPTP tunnel to be established between your
Shorewall system and the PPTP server in the modem.